5 Key Changes Coming in the CCPA Amendments

Next week, the California Senate Appropriations Committee will consider the fiscal impact of six bills to amend the California Consumer Privacy Act (CCPA). On the agenda are: AB-25 (employee data), AB-846 (loyalty programs), AB-874 (publicly available information), AB-1146 (vehicle information), AB-1355 (technical amendments) and AB-1564 (toll free number alternative).

With preparations in full swing at many covered businesses already, the Appropriations Committee is the final gatekeeper before a floor vote in the California Senate and reconciliation of the Senate changes with the Assembly versions of the bills. Before the summer recess, the debate in the Senate Judiciary Committee narrowed the number of amendments under consideration by a third as it approved only six of the nine CCPA amendments that passed their floor votes in the California State Assembly.

The remaining six bills make over forty changes to the text of the new California privacy law. Although many of them are technical amendments which will not make a difference to most CCPA compliance efforts, there are a handful of substantive changes which privacy professionals should be aware of as they continue their preparations. Here are the five which will have the biggest impact:

1. A One-year Delay on Employee Data

AB-25 will delay the impact of the CCPA on employee personal information for a year. The broad exclusion of employee data from the CCPA originally favored in the Assembly version of AB-25 has been removed in favor of a January 1, 2021 effective date so that the legislature can consider appropriate privacy legislation for employee data next year. If the business and consumer lobbies cannot agree on a consensus solution to the problem, then the CCPA will go into effect for employee data.

2. Account Verification

AB-25 also proposes changes to the CCPA text with regard to the submission of data subject access requests. The biggest change among them is that Section 1798.130(a)(2) will allow a business to require a consumer with an account to submit their verifiable consumer request through that account. The amendment to the text of the CCPA adds to the prior language which prohibited a business from requiring a consumer to create an account to to make an access or deletion request. This change will help businesses struggling with the problem of how to verify identity to achieve a verifiable consumer request.

3. Toll Free Number Alternative

AB-1564 modifies the toll-free telephone number requirement under the CCPA. According to the latest version, a business that operates exclusively online and has a direct consumer relationship will not need to provide a toll-free number under Section 1798.130(a)(1)(A). Instead, they are only required to provide an email address for consumers to submit right to access and delete requests, along with the law’s other requirements.

4. Third-Party Sales Disclosures

AB-1355 makes a number of technical amendments to the CCPA, including a change to Section 1798.115(a)(2) which clarifies the disclosures required regarding a business’ sale of personal information. When a business discloses its sales of personal information under AB-1355, they will only have to disclose the personal information sold to each category of third parties. They will not have to disclose the categories of personal information for each third party, as was previously required by the text.

5. Loyalty Programs

Any list of the proposed changes to the CCPA would be incomplete without discussing the carve-out in AB-846 to protect customer loyalty programs, which are overwhelmingly popular and used by consumers. Since the passage of the CCPA last year, businesses have called on changes to make clear that loyalty programs are allowed. However, the most recent changes to the language of AB-846 by the Senate narrow its effect greatly. This amendment may very well still see changes to it during the reconciliation process between the Senate and Assembly versions to reach a solution that works for both consumers and businesses.

The deadline for the California legislature to send legislation to the California Governor for signature is September 13, 2019, leaving three or so months for changes to be made to compliance programs before they go into effect. As you prepare over the next month, make sure that you are working from a version of the CCPA that incorporates the proposed changes or you may find that you were not preparing for the law that goes into effect in January!